Just a quick one before I go through and properly answer all your questions:
http://cpwiki.sf.net/Buffer_overrun
That's what you get for using C-style strings.